When a website gets hacked, the first thing most people ask is why someone would bother going after them. It is a fair question. Most of the sites we clean up belong to small New Zealand businesses who have never had a cross word with anybody.
The answer is usually that nobody did go after them. Almost none of this is personal. It is automated, it runs constantly, and it is looking for one specific thing: a door that was left open.
It is a machine, not a person.
There are bots working through the internet around the clock, checking site after site for known weaknesses. When a security hole is announced in a popular plugin, and they are announced most weeks, those bots have a list of every site running it within hours.
They are not reading your site or weighing up whether you are worth the effort. They are checking one thing, moving on, and checking the next. If your site answers in the way they are hoping for, it goes on a list, and something comes back later to make use of it.
This is why “we are too small to be a target” is the one assumption we would gently push back on. Being small does not make you invisible to something that never sleeps and does not care who you are.
Where they actually get in.
In our experience it comes down to a handful of things, and almost all of them are quiet housekeeping rather than anything dramatic.
A plugin nobody updated
This is the big one. A plugin gets a security fix, the update sits in the dashboard unread for months, and the site stays open long after the hole was public knowledge. It is rarely carelessness. It is usually that nobody was told an update mattered, or nobody owned the job at all. Owning that job is what our care plans are for.
A password that was already leaked
People reuse passwords, which is completely human. The trouble is that when an unrelated service is breached, those email and password pairs end up in lists that get tried against everything else. The password that leaked from a shopping site five years ago is now being tried on your website login.
Nothing watching in between
Most sites are only ever looked at when someone needs to change something. That can be weeks apart. A site can be compromised for a long time before anyone opens it and notices, and that gap is where the damage compounds.
Logins nobody remembers
Old staff accounts, a developer from three websites ago, an agency you stopped working with in 2022. Every one of those is a working key to the front door, and none of them are being looked after by anyone.
| How they get in | What you might notice | How it gets closed |
|---|---|---|
| An outdated plugin | Nothing at all, until pages or links appear that you did not add | Updates applied promptly, and plugins you do not use removed |
| A reused password | A login at an odd hour, or a password that stops working | A unique password per site, plus two factor authentication |
| Nothing monitoring the site | Weeks of quiet, then a warning from Google or your host | Overnight scanning, with alerts when something changes |
| Forgotten admin logins | An account in your user list you cannot place | A review of who has access, and removing anyone who has left |
What it looks like when it has happened.
A hacked site rarely announces itself. Defacement, where the homepage is replaced with a message, is actually the rare and lucky case, because at least you know immediately. Most compromises are quiet on purpose, because the longer they go unnoticed the more use they are.
The signs worth knowing are usually small. Pages or posts you did not write. Links to unrelated products buried in your content. Your site appearing in search results for words that have nothing to do with your business. Customers saying they got an email from you that you never sent. A warning in Google Search Console, or your host quietly taking the site offline without much explanation.
If any of that sounds familiar, it is worth having someone look properly rather than hoping it settles down. It does not settle down on its own.
Why deleting the file does not fix it.
This is the part that catches people out, and it is the reason sites get cleaned and then reinfected a fortnight later.
Whoever got in almost never leaves a single thing behind. There will be a file you can find, and there will usually be several you cannot: a hidden administrator account, a modified core file that looks completely normal, a scheduled task sitting quietly in the background waiting to put everything back. Clean up only the part you can see, and the rest simply rebuilds it while you are getting on with your week.
Cleaning a site properly means working out what actually changed and when, going through every place something can hide, closing the way in, and then watching it afterwards to be certain it is genuinely gone. It also means getting any Google warnings lifted, because those linger long after the site itself is clean.
If it happens, do this first.
Do not panic, and do not start deleting things. Deleting files at random makes a site harder to clean and can destroy the evidence of how they got in, which is the one thing that stops it happening again.
Change your website password, and change it somewhere other than the site itself if you can. Tell whoever looks after your hosting. If you take payments or hold customer details, note down what the site has access to, because that shapes what needs to happen next. Then get someone to look at it properly.
It is fixable. We clean up sites like this regularly, and the outcome is nearly always better than the owner feared when they first rang.
Send it our way and we will tell you honestly what is going on. We find what changed, clean it out completely, and move you onto hosting that keeps it from happening again. The first assessment is free.
The bottom line
Almost every hacked site we see comes down to something ordinary. An update nobody applied, a password used twice, a login belonging to someone who left. Not bad luck, and not a business doing anything wrong, just a gap that nobody owned.
That is really the whole point of having someone look after a website rather than leaving it to run itself. Not because the internet is a frightening place, but because these are small jobs that only matter when they have been left undone.
